Resource Exhaustion via Unbounded Git Grep in Gitea

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions before 1.25.5 do not enforce a timeout on git grep searches, allowing expensive searches to consume server resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-26307

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.25.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea versions before 1.25.5, where the software does not enforce a timeout on git grep searches.

As a result, expensive or long-running git grep search operations can consume excessive server resources.

Impact Analysis

The vulnerability can lead to excessive consumption of server resources due to unbounded git grep searches.

This may cause performance degradation, denial of service, or unavailability of the Gitea service for legitimate users.

Hi! I’m here to help you understand CVE-2026-26307. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70